commonwealth v gelfgatt

Term

NOTICE: The slip opinions and orders posted on this Web site are subject to formal revision and aresuperseded by the advance sheets and bound volumes of the Official Reports. This preliminary material willbe removed from the Web site once the advance sheets of the Official Reports are published. If you find atypographical error or other formal error, please notify the Reporter of Decisions, Supreme Judicial Court,John Adams Courthouse, 1 Pemberton Square, Suite 2500, Boston, MA 02108-1750; (617) 557-1030;[email protected]

COMMONWEALTH vs. Leon I. GELFGATT.

SJC-11358.

Suffolk. Nov. 5, 2013. - June 25, 2014.

Forgery. Uttering Forged Instrument. Larceny. False Pretenses. Witness, Compelling giving of evidence,Self-incrimination. Evidence, Information stored on computer, Testimonial statement. Search and Seizure,Computer. Constitutional Law, Self-incrimination.

INDICTMENTS found and returned in the Superior Court Department on May 7, 2010.

A pretrial motion to compel evidence was heard by Raymond J. Brassard, J., and a question of law wasreported by him.

The Supreme Judicial Court on its own initiative transferred the case from the Appeals Court.

Randall E. Ravitz, Assistant Attorney General (Thomas D. Ralph, Assistant Attorney General, with him) forthe Commonwealth.

Paul Joseph Davenport (Stanley D. Helinski with him) for the defendant.

The following submitted briefs for amici curiae:

Daniel B. Garrie, of Washington, & Daniel K. Gelb, for Daniel K. Gelb & others. David H. Margolis, ofFlorida, for Florida Department of Law Enforcement & others.

Mark R. Gage & Christian J. Desilets, of West Virginia, for National White Collar Crime Center.

David W. Opderbeck, of New Jersey, for David W. Opderbeck & others.

Nathan F. Wessler, of New York, Hanni M. Fakhoury, of California, & Matthew R. Segal, Jessie J. Rossman,& Kit Walsh, for American Civil Liberties Union Foundation of Massachusetts & others.

Victoria L. Nadel, for Massachusetts Association of Criminal Defense Lawyers.

Present: Ireland, C.J., Spina, Cordy, Botsford, Gants, Duffly, & Lenk, JJ.

SPINA, J.

Westlaw Result http://weblinks.westlaw.com/result/default.aspx?action=Search...

1 of 23 6/26/14, 6:56 AM

On May 5, 2010, a State grand jury returned indictments charging the defendant with seventeen counts offorgery of a document, G.L. c. 267, § 1; seventeen counts of uttering a forged instrument, G.L. c. 267, §5; and three counts of attempting to commit the crime of larceny by false pretenses of the property ofanother, G.L. c. 274, § 6. The charges arose from allegations that the defendant, through his use ofcomputers, conducted a sophisticated scheme of diverting to himself funds that were intended to be usedto pay off large mortgage loans on residential properties. On November 21, 2011, the Commonwealth filedin the Superior Court a "Motion to Compel the Defendant to Enter His Password into Encryption SoftwareHe Placed on Various Digital Media Storage Devices that Are Now in the Custody of the Commonwealth"(motion to compel decryption). The Commonwealth also filed a motion to report a question of law to theAppeals Court prior to trial pursuant to Mass. R.Crim. P. 34, as amended, 442 Mass. 1501 (2004). Thequestion concerned the lawfulness of compelling the defendant to privately enter an encryption key intocomputers seized from him by the Commonwealth. [FN1] Following a hearing on January 18, 2012, ajudge denied the Commonwealth's motion to compel decryption, but he reported the following question oflaw:

"Can the defendant be compelled pursuant to the Commonwealth's proposed protocol to provide his key toseized encrypted digital evidence despite the rights and protections provided by the Fifth Amendment tothe United States Constitution and Article Twelve of the Massachusetts Declaration of Rights?"

[FN2]

We transferred the case to this court on our own motion. [FN3] We now conclude that the answerto the reported question is, "Yes, where the defendant's compelled decryption would notcommunicate facts of a testimonial nature to the Commonwealth beyond what the defendantalready had admitted to investigators." Accordingly, we reverse the judge's denial of theCommonwealth's motion to compel decryption. [FN4]

1. Background. The undisputed facts are taken from the parties' submissions to the motion judge.[FN5]

Beginning in 2009, the defendant, who is an attorney, allegedly orchestrated a scheme to acquirefor himself funds that were intended to be used to pay off home mortgage loans. According to theCommonwealth, the defendant identified high-end properties that were listed in an online databaseas "under agreement." He would research each one at the applicable registry of deeds todetermine whether there was a mortgage on the property. If there was, the defendant,purportedly using a computer, would forge an assignment of the mortgage to either "PurenVentures, Inc." (Puren Ventures) or "Baylor Holdings, Ltd." (Baylor Holdings). He then wouldrecord the forged assignment at the applicable registry of deeds and mail a notice to the sellerstating that the mortgage on the property had been assigned to one of these sham companies,which he had set up.

The defendant fostered the illusion that Puren Ventures and Baylor Holdings were actualcompanies by giving each one Internet-based telephone and facsimile numbers. When a closingattorney would contact one of these companies to request a statement documenting the sumnecessary to pay off the reassigned mortgage, the attorney would be instructed to send therequest to the facsimile number that the defendant had created. Next, the defendant wouldrequest an actual payoff figure from the true mortgage holder. The defendant would transmit thisinformation by Internet facsimile number to the closing attorney, doing so under the guise of thesham company. The defendant would instruct the closing attorney to send the payoff check to aBoston address where the defendant once had practiced law. Although ultimately unsuccessful, thedefendant purportedly created seventeen fraudulent assignments of mortgages, totaling over $13million. According to the Commonwealth, the defendant relied heavily on the use of computers to


2 of 23 6/26/14, 6:56 AM

conceal his identity and perpetrate his alleged scheme.

On December 17, 2009, State police troopers arrested the defendant immediately after heretrieved what he believed to be over $1.3 million in payoff funds from two real estate closings.They also executed search warrants for his residence in Marblehead and for his vehicle. During thesearch of the defendant's residence, troopers observed several computers that were powered on,and they photographed the computer screens. [FN6] The troopers seized from the defendant'sresidence two desktop computers, one laptop computer, and various other devices capable ofstoring electronic data. [FN7] They also seized one smaller "netbook" computer from thedefendant's vehicle. Computer forensic examiners were able to view several documents and"bookmarks" to Web sites that were located on an external hard drive. [FN8] However, all of thedata on the four computers were encrypted with "DriveCrypt Plus" software.

[FN9]

According to the Commonwealth, the encryption software on the computers is virtually impossibleto circumvent. Its manufacturer touts the fact that it does not contain a "back door" that wouldallow access to data by anyone other than the authorized user. Thus, the Commonwealth states,the files on the four computers cannot be accessed and viewed unless the authorized user firstenters the correct password to unlock the encryption. The Commonwealth believes that evidenceof the defendant's purported criminal activities is located on these computers.

On the day of his arrest, the defendant was interviewed by law enforcement officials after havingbeen advised of the Miranda rights. In response to questioning, he said that he had more than onecomputer in his home. The defendant also informed the officials that "[e]verything is encryptedand no one is going to get to it." In order to decrypt the information, he would have to "start theprogram." The defendant said that he used encryption for privacy purposes, and that when lawenforcement officials asked him about the type of encryption used, they essentially were asking forthe defendant's help in putting him in jail. The defendant reiterated that he was able to decryptthe computers, but he refused to divulge any further information that would enable a forensicsearch.

On November 21, 2011, the Commonwealth filed its motion to compel decryption pursuant toMass. R.Crim. P. 14(a)(2), as appearing in 442 Mass. 1518 (2004). It sought an order compellingthe defendant's compliance with a "protocol" that the Commonwealth had established to obtaindecrypted digital data. [FN10] As grounds for the motion, the Commonwealth stated thatcompelling the defendant to enter the key to encryption software on various digital media storagedevices that had been seized by the Commonwealth was essential to the discovery of "material" or"significant" evidence relating to the defendant's purported criminal conduct. The Commonwealthfurther stated that its protocol would not violate the defendant's rights under either the FifthAmendment to the United States Constitution or art. 12 of the Massachusetts Declaration ofRights.

In denying the Commonwealth's motion to compel decryption, the judge said that, on the onehand, the Commonwealth merely was requesting a sequence of numbers and characters thatwould enable it to access information on the computers, but that, on the other hand, theCommonwealth was asking for the defendant's help in accessing potentially incriminating evidencethat the Commonwealth had seized. In the judge's view, there was merit to the defendant'scontention that production of a password to decrypt the computers constituted an admission ofknowledge, ownership, and control. Further, the judge continued, the scenario presented in this


3 of 23 6/26/14, 6:56 AM

case was far different from compelling a defendant to provide a voice exemplar, a handwritingexemplar, or a blood sample, all of which are deemed to be nontestimonial. The judge said thatthe defendant's refusal to disclose the encryption key during his interview with law enforcementofficials could be construed as an invocation of his rights under the Fifth Amendment and art. 12.Finally, it was the judge's understanding that neither the Federal nor the State Constitutionrequires a defendant to assist the government in understanding evidence that it has seized from adefendant.

2. Decryption under the Fifth Amendment. The Commonwealth contends that compelling thedefendant to enter his encryption key into the computers pursuant to the Commonwealth'sprotocol would not violate the defendant's Fifth Amendment right against self-incrimination. In theCommonwealth's view, the defendant's act of decryption would not communicate facts of atestimonial nature to the government beyond what the defendant already has admitted toinvestigators. As such, the Commonwealth continues, the defendant's act of decryption does nottrigger Fifth Amendment protection. We agree. [FN11]

The Fifth Amendment provides that "[n]o person ... shall be compelled in any criminal case to be awitness against himself." [FN12] See Couch v. United States, 409 U.S. 322, 328 (1973) ("It isextortion of information from the accused himself that offends our sense of justice"). It is wellestablished that "the Fifth Amendment does not independently proscribe the compelled productionof every sort of incriminating evidence but applies only when the accused is compelled to make atestimonial communication that is incriminating" (emphasis in original). Fisher v. United States,425 U.S. 391, 408 (1976). See United States v. Hubbell, 530 U.S. 27, 34 (2000) ("The word'witness' in the constitutional text limits the relevant category of compelled incriminatingcommunications to those that are 'testimonial' in character"); Schmerber v. California, 384 U.S.757, 761 (1966) ("[T]he privilege protects an accused only from being compelled to testify againsthimself, or otherwise provide the State with evidence of a testimonial or communicative nature").See also Commonwealth v. Hughes, 380 Mass. 583, 588, cert. denied, 449 U.S. 900 (1980).

Here, the Commonwealth, through its motion, is seeking to compel the defendant to decrypt "all"of the "digital storage devices that were seized from him." Given that the Commonwealth believesthat those devices contain information about the defendant's alleged mortgage payoff scheme, theentry of the encryption key or password presumably would be incriminating because "it wouldfurnish the Government with a link in the chain of evidence leading to [the defendant's]indictment." Doe v. United States, 487 U.S. 201, 207 n. 5 (1988), and accompanying text. Theissue on which this case turns is whether the defendant's act of decrypting the computers is atestimonial communication that triggers Fifth Amendment protection.

Although the Fifth Amendment privilege typically applies to oral or written statements that aredeemed to be testimonial, United States v. White, 322 U.S. 694, 698 (1944), the act of producingevidence demanded by the government may have "communicative aspects" that would render theFifth Amendment applicable. Fisher, 425 U.S. at 410. See Hubbell, 530 U.S. at 36. See alsoCommonwealth v. Burgess, 426 Mass. 206, 211 (1997) ("The Fifth Amendment privilege againstself-incrimination applies not only to verbal communications, but ... also to nonverbal acts thatimply assertions"). Whether an act of production is testimonial depends on whether thegovernment compels the individual to disclose "the contents of his own mind" to explicitly orimplicitly communicate some statement of fact. Hubbell, supra at 43, quoting Curcio v. UnitedStates, 354 U.S. 118, 128 (1957). See Doe v. United States, 487 U.S. at 213 (Fifth Amendmentintended "to spare the accused from having to reveal, directly or indirectly, his knowledge of factsrelating him to the offense or from having to share his thoughts and beliefs with the


4 of 23 6/26/14, 6:56 AM

Government"). See also Pennsylvania v. Muniz, 496 U.S. 582, 595 n. 9 (1990) (opinion ofBrennan, J.) ("nonverbal conduct contains a testimonial component whenever the conduct reflectsthe actor's communication of his thoughts to another"). More particularly, the act of complyingwith the government's demand could constitute a testimonial communication where it isconsidered to be a tacit admission to the existence of the evidence demanded, the possession orcontrol of such evidence by the individual, and the authenticity of the evidence. See Hubbell, supraat 36 & n. 19; United States v. Doe, 465 U.S. 605, 613-614 & n. 11 (1984); Fisher, supra. Seealso Commonwealth v. Burgess, supra; Commonwealth v. Hughes, 380 Mass. at 592. Thedetermination whether an act of producing evidence in response to a governmental demand issufficiently testimonial that it renders the Fifth Amendment applicable "depend[s] on the facts andcircumstances of [each] particular case[ ]." Fisher, supra. See Doe v. United States, 487 U.S. at214-215.

It is well established that not all acts of production have communicative aspects such that they willbe deemed testimonial. See Hubbell, 530 U.S. at 34-35; Doe v. United States, 487 U.S. at210-211. Significantly, the Fifth Amendment privilege is not triggered where the governmentseeks to compel an individual to be the source of real or physical evidence by, for example,furnishing a blood sample, Schmerber v. California, 384 U.S. at 764-765; producing a voiceexemplar, United States v. Dionisio, 410 U.S. 1, 5-7 (1973); standing in a lineup, United States v.Wade, 388 U.S. 218, 221-223 (1967); providing a handwriting exemplar, Gilbert v. California, 388U.S. 263, 266-267 (1967); or putting on particular clothing, Holt v. United States, 218 U.S. 245,252-253 (1910). See Commonwealth v. Brennan, 386 Mass. 772, 776-777 (1982) (breathalyzertest and field sobriety tests do not produce evidence of testimonial nature). The Fifth Amendmentprivilege is not implicated in these circumstances because the individual is "not required 'todisclose any knowledge he might have,' or 'to speak his guilt.' " Doe v. United States, supra at211, quoting United States v. Wade, supra at 222- 223. See Hubbell, supra at 35 ("The act ofexhibiting such physical characteristics is not the same as a sworn communication by a witnessthat relates either express or implied assertions of fact or belief"); Pennsylvania v. Muniz, 496 U.S.at 590-599 (discussing distinctions between production of "real or physical" evidence andproduction of "testimonial" communication for purposes of privilege against self-incrimination).

Here, the defendant's act of entering an encryption key in the computers seized by theCommonwealth would appear, at first blush, to be a testimonial communication that triggers FifthAmendment protection. By such action, the defendant implicitly would be acknowledging that hehas ownership and control of the computers and their contents. [FN13] This is not simply theproduction of real or physical evidence like a blood sample or a handwriting exemplar. Rather, thedefendant's act of entering the encryption key would be a communication of his knowledge aboutparticular facts that would be relevant to the Commonwealth's case. Our analysis, however, doesnot end here. We must further determine whether the defendant's act of production loses itstestimonial character because the information that would be disclosed by the defendant is a"foregone conclusion."

The "foregone conclusion" exception to the Fifth Amendment privilege against self-incriminationprovides that an act of production does not involve testimonial communication where the factsconveyed already are known to the government, such that the individual "adds little or nothing tothe sum total of the Government's information." Fisher, 425 U.S. at 411. For the exception toapply, the government must establish its knowledge of (1) the existence of the evidencedemanded; (2) the possession or control of that evidence by the defendant; and (3) theauthenticity of the evidence. See id. at 410-413; United States v. Bright, 596 F.3d 683, 692 (9thCir.2010). See also Hubbell, 530 U.S. at 40-41, 44-45 (government did not satisfy "foregone


5 of 23 6/26/14, 6:56 AM

conclusion" exception where no showing of prior knowledge of existence or whereabouts ofdocuments ultimately produced by respondent to subpoena); United States v. Doe, 465 U.S. at613-614 & nn. 11-13 (act of producing business records involved testimonial self-incriminationwhere government did not show that existence, possession, and authenticity of records were"foregone conclusion"). In those instances when the government produces evidence to satisfy the"foregone conclusion" exception, "no constitutional rights are touched. The question is not oftestimony but of surrender." Fisher, supra at 411, quoting Matter of Harris, 221 U.S. 274, 279(1911). See, e.g., United States v. Sideman & Bancroft, LLP, 704 F.3d 1197, 1202-1205 (9thCir.2013) (quantum of information possessed by Internal Revenue Service regarding existence andpossession of summonsed documents, together with evidence of their authenticity, satisfied"foregone conclusion" exception to Fifth Amendment privilege against self-incrimination); UnitedStates v. Fricosu, 841 F.Supp.2d 1232, 1237 (D.Colo.2012) (Fifth Amendment not implicated byrequiring production of unencrypted contents of computer where government knew of existenceand location of files, although not specific content of documents, and knew of defendant's custodyor control of computer); State v. Jancsek, 302 Or. 270, 287-288 (1986) (compelled production ofletter not protected by Fifth Amendment privilege where existence, contents, and authenticity ofletter already known to police). In essence, under the "foregone conclusion" exception to the FifthAmendment privilege, the act of production does not compel a defendant to be a witness againsthimself.

Based on our review of the record, we conclude that the factual statements that would beconveyed by the defendant's act of entering an encryption key in the computers are "foregoneconclusions" and, therefore, the act of decryption is not a testimonial communication that isprotected by the Fifth Amendment. The investigation by the corruption, fraud, and computer crimedivision of the Attorney General's office uncovered detailed evidence that at least two mortgageassignments to Baylor Holdings were fraudulent. During his postarrest interview with State policeTrooper Patrick M. Johnson, the defendant stated that he had performed real estate work forBaylor Holdings, which he understood to be a financial services company. He explained that hiscommunications with this company, which purportedly was owned by Russian individuals, werehighly encrypted because, according to the defendant, "[that] is how Russians do business." Thedefendant informed Trooper Johnson that he had more than one computer at his home, that theprogram for communicating with Baylor Holdings was installed on a laptop, and that "[e]verythingis encrypted and no one is going to get to it." The defendant acknowledged that he was able toperform decryption. Further, and most significantly, the defendant said that because of encryption,the police were "not going to get to any of [his] computers," thereby implying that all of themwere encrypted.

When considering the entirety of the defendant's interview with Trooper Johnson, it is apparentthat the defendant was engaged in real estate transactions involving Baylor Holdings, that he usedhis computers to allegedly communicate with its purported owners, that the information on all ofhis computers pertaining to these transactions was encrypted, and that he had the ability todecrypt the files and documents. The facts that would be conveyed by the defendant through hisact of decryption--his ownership and control of the computers and their contents, knowledge of thefact of encryption, and knowledge of the encryption key--already are known to the governmentand, thus, are a "foregone conclusion." [FN14] The Commonwealth's motion to compel decryptiondoes not violate the defendant's rights under the Fifth Amendment because the defendant is onlytelling the government what it already knows.

3. Decryption under art. 12. The Commonwealth also contends that compelling the defendant toenter his encryption key pursuant to the Commonwealth's protocol would not violate his privilege


6 of 23 6/26/14, 6:56 AM

against self-incrimination under art. 12 of the Massachusetts Declaration of Rights. We agree.

Article 12 provides that "[n]o subject shall ... be compelled to accuse, or furnish evidence againsthimself." It is well established that art. 12 affords greater protection against self-incrimination thandoes the Fifth Amendment in circumstances that are "discrete and well defined." [FN15]Commonwealth v. Burgess, 426 Mass. at 218. See Commonwealth v. Mavredakis, 430 Mass. 848,858-859 (2000). However, as we have explained, "[a]lthough art. 12 demands a more expansiveprotection, 'it does not change the classification of evidence to which the privilege applies. Onlythat genre of evidence having a testimonial or communicative nature is protected under theprivilege against self-incrimination.' " Commonwealth v. Burgess, supra, quoting Attorney Gen. v.Colleton, 387 Mass. 790, 796 n. 6 (1982). Like the Federal Constitution, the protection againstself-incrimination afforded by art. 12 is unavailable where the government seeks to compel anindividual to be the source of real or physical evidence. See Commonwealth v. Burgess, supra, andcases cited.

Similarly, we have held that, as is the case under the Federal Constitution, "the act of production,quite apart from the content of that which is produced, may itself be communicative."Commonwealth v. Doe, 405 Mass. 676, 679 (1989). See Commonwealth v. Hughes, 380 Mass. at592. Where the information conveyed by an act of production "is reflective of the knowledge,understanding, and thoughts of the witness," it is deemed to be testimonial and, therefore, withinthe purview of art. 12. Commonwealth v. Doe, supra. At the same time, we also have recognizedthat "[w]hen it is a 'foregone conclusion' that a witness has certain items, and the itemsthemselves are not privileged, the witness has no privilege." Id. at 680-681, citing Commonwealthv. Hughes, supra at 590, and Fisher v. United States, 425 U.S. at 411. See Commonwealth v.Diaz, 383 Mass. 73, 76 n. 5 (1981) (no serious constitutional issue of self-incrimination raised bydisclosure of information that is "foregone conclusion"). See also note 13, supra.

In Commonwealth v. Burgess, 426 Mass. at 219, when the court considered the scope of theprotection against self-incrimination afforded by both the Federal Constitution and theMassachusetts Declaration of Rights, we pointed out that our analysis under art. 12 need not"merely duplicate our earlier Fifth Amendment analysis." Rather, "[w]e are free to consider certainevidence, considered by the Supreme Court to be insufficiently testimonial for Fifth Amendmentpurposes, to be sufficiently testimonial for art. 12 purposes." Id. Mindful of this pronouncement, aswell as our jurisprudence recognizing the "foregone conclusion" principle, we are not persuadedthat the circumstances presented here dictate an analytical departure from the Federal standard.Where the facts that would be conveyed by the defendant through the act of entering anencryption key into the computers seized by the Commonwealth are a "foregone conclusion," hisact of production is insufficiently testimonial for art. 12 purposes. [FN16]

4. Conclusion. We answer the reported question, "Yes, where the defendant's compelleddecryption would not communicate facts of a testimonial nature to the Commonwealth beyondwhat the defendant already had admitted to investigators." The judge's denial of theCommonwealth's motion to compel decryption is reversed, and this case is remanded to theSuperior Court for further proceedings consistent with this opinion.

So ordered.

LENK, J (dissenting, with whom Duffly, J., joins).

The court holds today that the defendant, an attorney who practices from his home, may be


7 of 23 6/26/14, 6:56 AM

ordered to enter decryption keys sequentially on each and every electronic device seized from hishome, his home office, and his automobile, in order to provide law enforcement officers withunencrypted access to those devices. [FN1] Such an order is the functional equivalent of requiringhim to produce the unencrypted contents of the devices seized. The government suspects thatsome unspecified set of documents related to a mortgage fraud scheme may be located on one ormore of these devices, [FN2] which the government thus far has been unable to read because ofthe encryption. I agree with the court that this act of decryption is compelled, testimonial, andpotentially incriminating. Unlike the court, I conclude that this also holds true for the intrinsicallylinked act of thereby producing in unencrypted form any material that may be on the nowencrypted devices. Further, I do not agree that the Commonwealth has shown sufficientknowledge of the existence, location, and authenticity of the documents it seeks such that theinformation that would be revealed by decryption and production is a "foregone conclusion," andtherefore that requiring the defendant to decrypt the devices would not violate his constitutionalprivilege against self-incrimination. Because I believe that the act of compelled entry of the codesto decrypt the seized devices, thereby producing the unencrypted contents of those devices, isprotected under both the Fifth Amendment to the United States Constitution and art. 12 of theMassachusetts Declaration of Rights, I respectfully dissent.

1. Act of production and authentication. The court concludes that the act of decrypting the devicespursuant to the Commonwealth's proposed protocol, which necessarily would produce inunencrypted form any files stored thereon to which the encryption key would permit access, is notanalogous to the act of responding to a subpoena to produce a document, where the act ofproduction would be testimonial because it makes an assertion that, among other things, thedocument produced is authentic. To reach this conclusion, the court adopts the Commonwealth'scontention that, by decrypting the computers and thereby producing their unencrypted contents,the defendant would be asserting only his ability to decrypt the devices. On this view, he wouldnot be asserting that he owned them, had exclusive use and control of them, or was familiar withany of the files on them; that certain files contained the incriminating evidence sought; or that thedocuments were authentic. Such is far from the case.

In taking this view of the matter, the court maintains that the defendant merely would be enteringa password, which he would not disclose to the Commonwealth, into the encryption program, andwould not thereby be selecting and producing any documents. Such an artificial distinctionbetween the act of entering the decryption key and the inevitable result of decrypting the devices,[FN3] and thereby producing the files for inspection, obfuscates the reality of what the defendantis being compelled to disclose. The Commonwealth seeks the decryption order at issue not for itsown sake, but rather to enable the government to access the documents it sought when obtainingthe search warrant permitting it to seize the devices. Here, as the United States Court of Appealsfor the Eleventh Circuit concluded in similar circumstances, "the decryption and production wouldbe tantamount to testimony by [the defendant] of his knowledge of the existence and location ofpotentially incriminating files; of his possession, control, and access to the encrypted portions ofthe drives; and of his capability to decrypt the files." In re Grand Jury Subpoena Duces TecumDated March 25, 2011, 670 F.3d 1335, 1346 (2012) (In re Subpoena Duces Tecum ). Inexorably,once the decryption key is entered, the names and sizes of the files (if any) to which the defendanthas access on that computer will be produced, the amount of unused space available to thedefendant on that computer will become known, and the contents of any files will be madeaccessible to the Commonwealth. [FN4]

Moreover, the defendant has denied that there are any documents related to Baylor Holdings, Ltd.(Baylor), on that subset of the seized devices of which he has acknowledged ownership, denied


8 of 23 6/26/14, 6:56 AM

that he created any documents for Baylor,[FN5] denied that the encrypted communication program he used to communicate withBaylor continues to be installed on those devices, and denied that there are any savedrecords of the encrypted communications he had withBaylor employees. If the defendant is compelled to decrypt the devices, and any suchdocuments are produced thereby, the act of decryption will have resulted in a priorinconsistent statement by the defendant, which the Commonwealth may seek to use againsthim at trial. [FN6]

In light of all this, I would conclude that both the acts of decrypting the devices and of inexorablyproducing thereby the unencrypted contents of the devices that the Commonwealth otherwisecannot now access are testimonial. See United States v. Hubbell, 530 U.S. 27, 43 (2000) (Hubbell); Doe v. United States, 487 U.S. 201, 212 (1988).

2. Foregone conclusion. The court concludes that the act of entering the codes to decrypt thedevices would not infringe upon the defendant's privilege against self-incrimination. The court is ofthe view that the defendant already has disclosed during an interview with State troopers anythingthat, absent such disclosures, might be testimonial about the act of decryption. In particular, thecourt concludes that the facts which might be learned through the act of decryption--ownershipand control of the seized devices--have been revealed previously by the defendant, or are alreadyknown by the Commonwealth through other means, and therefore that the "foregone conclusion"exception applies to what otherwise would be testimonial conduct. The court does not considerwhether the act of production, also in my view testimonial, is encompassed within the foregoneconclusion exception.

"The touchstone of whether an act of production is testimonial is whether the government compelsthe individual to use 'the contents of his own mind' to explicitly or implicitly communicate somestatement of fact." In re Subpoena Duces Tecum, 670 F.3d at 1345, quoting Curcio v. UnitedStates, 354 U.S. 118, 128 (1957). Under the foregone conclusion doctrine, an otherwisetestimonial act of production is not testimonial if the government establishes that, at the time itsought the compelled production, it already knew of that which would explicitly or implicitly beconveyed by the production. Fisher v. United States, 425 U.S. 391, 410-411 (1976) (Fisher ). SeeHubbell, supra at 36 n. 19, 43-45 (act of production testimonial if by compelled conduct "thewitness would admit that the papers existed, were in his possession or control, and wereauthentic"; inquiry turns on extent of government's prior knowledge of existence and location ofdocuments produced); United States v. Ponds, 454 F.3d 313, 320-321 (D.C.Cir.2006).

a. Reasonable particularity standard. In addressing the extent of knowledge that the governmentmust establish in order to invoke the "foregone conclusion" doctrine, four circuit courts of theUnited States Court of Appeals have concluded that the government must show with "reasonableparticularity" that it already knows the "location, existence, and authenticity of the purportedevidence." In re Subpoena Duces Tecum, 670 F.3d at 1344 & n. 20. See United States v. Ponds,supra at 320-321; In re Grand Jury Subpoena Dated April 18, 2003, 383 F.3d 905, 910 (9thCir.2004); In re Grand Jury Subpoena Duces Tecum Dated October 29, 1992, 1 F.3d 87, 93 (2dCir.1993), cert. denied sub nom. Doe v. United States, 510 U.S. 1091 (1994).

Treating computer files as documents, the United States Court of Appeals for the Eleventh Circuitis, to date, the only circuit court to have addressed the issue specifically in the context ofencrypted computers. Concluding that a defendant's compelled decryption and production of the


9 of 23 6/26/14, 6:56 AM

contents of computer drives and external hard drives would be sufficiently testimonial to triggerFifth Amendment protections, the court determined that "an act of production is nottestimonial--even if the act conveys a fact regarding the existence or location, possession, orauthenticity of the subpoenaed materials--if the Government can show with 'reasonableparticularity' that, at the time it sought to compel the act of production, it already knew of thematerials, thereby making any testimonial aspect a 'foregone conclusion.' " In re Subpoena DucesTecum, 670 F.3d at 1345-1346. To establish a foregone conclusion, "[t]he government does nothave to show that it knows specific file names," but would have to "show with some reasonableparticularity that it seeks a certain file and is aware, based on other information, that (1) the fileexists in some specified location, (2) the file is possessed by the target of the subpoena, and (3)the file is authentic." Id. at 1349 n. 28.

While the United States Court of Appeals for the First Circuit has yet to consider the issue, I wouldadopt, at a minimum for purposes of art. 12, the same reasonable particularity standard forestablishing a foregone conclusion that other circuit courts have adopted, and would conclude thatthe Commonwealth has not met that burden here. See id. at 1346, 1349 (no evidence "that theGovernment, at the time it sought to compel production, knew to any degree of particularity what,if anything, was hidden behind the encrypted wall"). Contrast United States v. Fricosu, 841F.Supp.2d 1232, 1235-1237 (D.Colo.2012) (existence and location of files foregone conclusionwhere government introduced recorded conversation of defendant and third party in which shesaid that file sought "was on my laptop").

b. Extent of government's knowledge in this case. Here, the Commonwealth has made no showingthat the existence, possession, and authenticity of the broad categories of items sought areforegone conclusions, under any definition of that term. The court focuses on the defendant'sapparent access to the devices seized, and his statements that he owns a "laptop," that"everything is encrypted," and that he could decrypt at least one device ("my computer"). In sodoing, it conflates the probable cause showing that the Commonwealth was required to make inorder to seize the devices in the first instance with the showing that the Commonwealth mustmake when, as here, it seeks the otherwise testimonial assistance of a defendant in accessing thecontents of those devices. [FN7] The showing that the Commonwealth must make as to itsknowledge of the contents of those devices in order to render anything revealed by the decryptionand production of that content a foregone conclusion is significantly greater than what is requiredto show probable cause. Hence, the "reasonable particularity" standard requires much more thangovernment knowledge that a defendant owns or has access to a particular computer.

Even under the less specific requirements articulated in Hubbell, supra, moreover, thegovernment's burden of establishing that, at the time it sought to compel decryption andproduction, it already knew of the documents sought, rendering any testimonial aspect of thatconduct a foregone conclusion, is not met by a showing that a defendant had in his house what isessentially a locked file cabinet in which such documents might have been kept. See In reSubpoena Duces Tecum, 670 F.3d at 1347 n. 25 ("This situation is no different than if theGovernment seized a locked strongbox. Physical possession of the entire lockbox is not the issue;whether the Government has the requisite knowledge of what is contained inside the strongbox isthe critical question").

i. Existence and content of documents sought. Aside from knowledge pertinent to the existenceand nature of the encryption program itself, [FN8] the government has not shown that it has anyknowledge as to the existence or content of any particular files or documents on any particularcomputer.


10 of 23 6/26/14, 6:56 AM

[FN9] To the contrary, the Commonwealth's computer forensic expert's affidavit providesgeneral information about what computers can do, but makes no specific assertions as toany files or documents expected to be found on any of the seized devices. The focus of thetrooper's affidavit is on the defendant's actions away from his home, as observed by policesurveillance. [FN10] Not only is there no description of files that are expected to be found,[FN11] let alone that are known to exist, on the defendant's computers, [FN12] the affidavitcontains numerous indications of the defendant's apparent efforts to avoid downloadingdocuments to his computers, using telephone or facsimile transmission from his house.Service providers' Web sites that the Commonwealth asserts the defendant used, [FN13] aredescribed as advertising that documents are stored on the third-party service providers'computers, and may be accessed over the Internet without downloading anything to a user'sown computer. See G. Jacobs & K. Laurence, ProfessionalMalpractice § 17.1 (2013) (discussing "cloud computing" as "in essence a sophisticated formof remote electronic data storage on the Internet.... Unlike traditional methods that maintaindata on a computer or service at a law office or other place of business, data stored 'in thecloud' [cloud computing] is kept on large servers located elsewhere and maintained by avendor"). The Commonwealth accordingly has not shown that it knows "with somereasonable particularity that it seeks a certain file and is aware, based on other information,that (1) the file exists in some specified location, (2) the file is possessed by the target of thesubpoena, and (3) the file is authentic." In re Subpoena Duces Tecum, 670 F.3d at 1349 n.28.

"In Fisher, [supra at 411,] ... the act of production was not testimonial because the Governmenthad knowledge of each fact that had the potential of being testimonial. As a contrast, the Court inHubbell [, supra at 44- 45,] found there was testimony in the production of the documents sincethe Government had no knowledge of the existence of documents, other than a suspicion thatdocuments likely existed and, if they did exist, that they would fall within the broad categoriesrequested." In re Subpoena Duces Tecum, 670 F.3d at 1345. Here, too, the government has nomore than a suspicion that broad categories of documents, extending over periods of years, mayexist on one or more of the seized devices. See United States v. Doe, 465 U.S. 605, 613-614 & nn.11-13 (1984). See, e.g., Commonwealth v. Hughes, 380 Mass. 583, 592, cert. denied, 449 U.S.900 (1980) (act of producing gun by defendant charged with assault by means of dangerousweapon would not convey "merely trivial new knowledge" but would communicate "just thosematters about which the Commonwealth desires but does not have solid information"). ContrastFisher, supra.

The court notes that the defendant has admitted to engaging in real estate transactions for Baylor,communicating with Baylor over an encrypted communication program installed on his laptop,using the Internet to communicate, having more than one computer, that "everything" on hiscomputer is encrypted, and that he knows how to decrypt it. The court points also to the fact thattwo of the mortgage assignments to Baylor apparently are fraudulent. [FN14] None of this,however, establishes anything about the government's knowledge of the documents, if any, thatmay be stored on the seized devices. [FN15] See In re Grand Jury Subpoena dated April 18, 2003,383 F.3d at 910 ("Although the government possessed extensive knowledge about [defendant's]price-fixing activities as a result of interviews with cooperating witnesses and [his] ownincriminating statements ..., it is the government's knowledge of the existence and possession ofthe actual documents, not the information contained therein, that is central to the foregoneconclusion inquiry").


11 of 23 6/26/14, 6:56 AM

Furthermore, the court misconstrues the extent of the defendant's statements concerning theencryption, thereby inferring that the defendant has asserted greater access and control than is infact the case. The court conflates the encryption of the disk drive on one of the computers, whichthe defendant acknowledged, with the existence of the encrypted communication program

[FN16] purportedly used to communicate with Baylor. [FN17] Contrary to the court'sstatement, the defendant has not said that the communication program that he ran in orderto communicate with someone at Baylor is installed on any of his computers at this time;indeed, he stated explicitly that it had been installed on his "laptop" but that it might nolonger be there and that the program itself "may not exist anymore." [FN18]

On this record, the Commonwealth does not know what is stored on any of the seized devices, or ifany of them contain information relevant to the charged offenses. Notwithstanding the court'sconclusion to the contrary, the affidavit in support of the search warrant and the defendant'sstatements to police do not give rise to a foregone conclusion that whatever would be revealed bythe defendant's entry of the decryption key, and consequent production of the unencryptedcontents of all of the seized devices, is already known to the government. See Hubbell, supra at 45("the overbroad argument that a businessman ... will always possess general business and taxrecords," could not "cure [the] deficiency" of government's failure to demonstrate its "priorknowledge of either the existence or the whereabouts" of requested documents); In re Grand JurySubpoena Dated April 18, 2003, 383 F.3d at 911 ("A subpoena such as this, which seeks alldocuments within a category but fails to describe those documents with any specificity indicatesthat the government needs the act of production to build its case against [the defendant]"). Seealso United States v. Doe, 465 U.S. at 614 n. 12.

Even more fundamentally, to establish a foregone conclusion the government must first show thatit knows any files at all exist on a particular computer. In In re Subpoena Duces Tecum, 670 F.3dat 1346, 1349, the United States Court of Appeals for the Eleventh Circuit reversed an orderrequiring a suspect to decrypt his computer, which was using the same type of encryption programthat the Commonwealth's expert avers is being used to encrypt the devices here, because thecourt concluded that the government had not shown that any files existed on the computer, otherthan the encryption program itself. The encryption program at issue not only encrypts informationstored on a computer, it also encrypts all unused space on the computer's hard drive, making itimpossible to determine how much of the computer contains actual files and how much is unusedor blank. Because the government could not show that any data on the computer representedactual files, the court concluded that ("[t]he [g]overnment has failed to show any basis, let aloneshown a basis with reasonable particularity, for its belief that encrypted files exist on the drives..."). Id. at 1349. Given the properties of the encryption program in place on the seized deviceshere, as described by the Commonwealth's expert, the Commonwealth does not know whetherthey contain any documents of any kind.

ii. Ownership, exclusive use, and control. The court's decision also conflates access to a particularcomputer [FN19] with access to, and knowledge and control of, each of the files on that computer.[FN20] As stated, the United States Supreme Court has rejected the view that a defendant'saccess to a locked cabinet, whose contents are not known but that might contain the documentssought, is sufficient to establish that the government knows the contents of those documents,such that their compelled production by unlocking the cabinet is a foregone conclusion. Hubbell,supra. This distinction is even more critical in considering the issue of production or search of filesstored on a computer. See In re Subpoena Duces Tecum, 670 F.3d at 1346, 1349; United Statesv. Fricosu, 841 F.Supp.2d 1232, 1235-1237 (D.Colo.2012). Like many courts to have considered


12 of 23 6/26/14, 6:56 AM

the issue, we have concluded that each computer file is a separate document in a closed container,requiring that searches of a computer to locate specific files must be limited and particular. SeeCommonwealth v. McDermott, 448 Mass. 750, 775, cert. denied, 552 U.S. 910 (2007). See UnitedStates v. Potts, 586 F.3d 823, 833 (10th Cir.2009) ("officers must be clear as to what it is they areseeking on the computer and conduct the search in a way that avoids searching files of types notidentified in the warrant"). See, e.g., United States v. Mann, 592 F.3d 779, 786 (7th Cir.), cert.denied, 130 S.Ct. 3525 (2010), and cases cited; United States v. Burgess, 576 F.3d 1078,1088-1089 (10th Cir.), cert. denied, 558 U.S. 1097 (2009); United States v. Carey, 172 F.3d1268, 1270-1273 (10th Cir.1999); United States v. Stierhoff, 477 F.Supp.2d 423, 439 n. 8(D.R.I.2007), aff'd, 549 F.3d 19 (1st Cir.2008). See generally Goldfoot, The Physical Computerand the Fourth Amendment, 16 Berkeley J.Crim. L. 112 (2011); Kerr, Searches and Seizures in aDigital World, 119 Harv. L.Rev. 531 (2005); Trepel, Digital Searches, General Warrants, and theCase for the Courts, 10 Yale J.L. & Tech. 120 (2007). Therefore, the government must establishknowledge of the existence of the particular file, either by the name of the file or by knowledge ofits contents, as well as the defendant's access to that portion of the encrypted drive on which thefile exists. See In re Subpoena Duces Tecum, 670 F.3d at 1346, 1349. It has not done so here.

3. Attorney-client privilege. I would conclude also that the defendant cannot be compelled to enterthe decryption key, and thereby produce all documents to which he has access, on each device,under the protocol as proposed by the Commonwealth, because of the possibility that thecomputers contain privileged information relating to the defendant's legal clients. See PreventiveMedicine Assocs. v. Commonwealth, 465 Mass. 810, 822-824 & nn. 24-26 (2013) ("a search, to bereasonable, must include reasonable steps designed to prevent a breach of the attorney-clientprivilege.... [T]he harm to the defendant could be irreparable if the Commonwealth viewedprivileged materials, even if only by accident"). The issue of attorney-client privilege is notaddressed in the search warrant affidavit, the protocol proffered in conjunction with theCommonwealth's motion to compel, or the court's decision. [FN21]

The defendant told police that he ran a law office from his house, and that he had approximatelyten active personal injury clients. He stated that he sent facsimile transmissions to his personalinjury clients, when necessary, using TrustFax, an Internet facsimile site, from his home computer.He acknowledged that "my computer" is encrypted, but did not identify which one of the seizeddevices he meant, and asserted that the encryption was to protect his "privacy." The policephotographs of one of the computer screens when that computer was running, showing thedirectory name "K: Leon Documents My Scans" and an icon labeled "Attorney Leon I. Gelfgatt," donot indicate that the documents, if any, on the computers relate to Baylor and not to thedefendant's other clients. Nor do they show that the computers contain any documents related toBaylor. Because the proposed protocol potentially would allow the Commonwealth to viewprivileged information related to the defendant's other clients, I would conclude, on this basis aswell, that the requested order to compel is unreasonable and impermissible.

4. Conclusion. Because I believe that the compelled decryption and production here isfundamentally testimonial, and the Commonwealth has not established a foregone conclusion thatthe existence, location, and authenticity of the information that would be produced is known to thegovernment, I respectfully dissent, and would answer the reported question, "No."

FN1. The parties treat as synonymous the terms "encryption key" and "password" toencryption software. For the sake of simplicity, we shall do the same.


13 of 23 6/26/14, 6:56 AM

FN2. The parties have not included in the record appendix a copy of the order reporting thequestion of law from the Superior Court. We rely on a joint stipulation of the parties filed onJuly 19, 2012, that sets forth thelanguage of the reported question.

FN3. All proceedings in the Superior Court have been stayed pending resolution of thereported question.

FN4. We acknowledge the amicus briefs submitted in support of the defendant by theAmerican Civil Liberties Union Foundation of Massachusetts, the American Civil LibertiesUnion Foundation, and the Electronic Frontier Foundation; by the Massachusetts Associationof Criminal Defense Lawyers; and by Daniel K. Gelb, Daniel B. Garrie, and the NationalAssociation of Criminal Defense Lawyers. We also acknowledge the amicus briefs submittedin support of the Commonwealth by David W. Opderbeck, the Massachusetts Chiefs of PoliceAssociation, Inc., and NW3C, Inc., doing business as the National White Collar Crime Center;by the

Florida Department of Law Enforcement, the Massachusetts Chiefs of Police Association, Inc.,NW3C, Inc., doing business as the National White Collar Crime Center, and the NationalDistrict Attorneys Association; and by NW3C, Inc., doing business as the National WhiteCollar Crime Center.

FN5. These submissions included an affidavit dated August 31, 2011, from David Papargiris,the director of the Attorney General's computer forensicslaboratory; an affidavit dated October 19, 2011, from State police Trooper Patrick M.Johnson; and the transcript of an audio recording of a postarrest interview of the defendantconducted on December 17, 2009, by law enforcement officers. The motion judge declined tomake findings of fact when ruling on the Commonwealth's motion to compel decryption,given that the only facts before him were those presented in the Commonwealth'ssubmissions. Defense counsel did not dispute the facts set forth in the affidavits andtranscript, recognizing that they spoke for themselves. He did, however, point out that hemight disagree with some of the characterizations of those facts.

FN6. Appearing on the computer screens were the following phrases that were visible asheadings or icons: "K: Leon Documents My Scans"; "Erasing Report"; "Erased area";"Attorney Leon I. Gelfgatt"; "TrueCrypt"; and "DriveCrypt Plus Pack."

FN7. Apart from the computers, troopers seized an Adaptec external hard drive, twouniversal serial bus (USB) thumb drives, two secure digital cards, two cellular telephones,and fourteen compact discs.

FN8. These documents included what appeared to be unsigned releases for a mortgage


14 of 23 6/26/14, 6:56 AM

encumbering the defendant's residential property in Marblehead.Computer forensic examiners also were able to see an image file that appeared to containthe seal for an Arizona notary public. The "bookmarks" included a Web site where PurenVentures was advertised for sale, and a Web site offering anonymous wire transfers.

FN9. In an affidavit submitted in connection with the Commonwealth's motion to compeldecryption, the director of the Attorney General's computer forensics laboratory explainedthe differences between encryption and decryption:

"Encryption is the process by which 'readable' digital media, that is, digital media or datathat can be viewed and accessed, is scrambled in such a way as to render that digital mediaor data 'unreadable' without decryption. Encryption can be performed both by hardware andby means of software tools.

"Decryption is the process by which encrypted, scrambled data is rendered 'readable' again.In order to

decrypt data, the person seeking decryption performs some action such as the entering of apassword, scanning of a fingerprint or [insertion of] a USB Thumb drive with a pass code keyon it. The encryption software then translates this action into a 'key,' essentially a string ofnumbers or characters. The encryption software then applies this key to the encrypted datausing the algorithm of the given encryption program. By funneling the encrypted datathrough the algorithm, the data is rendered 'readable' again."

FN10. The Commonwealth's "protocol" is as follows:

"1. The defendant, in the presence of his counsel, shall appear at the Computer ForensicsLaboratory of Massachusetts Attorney General Martha Coakley within 7 days from the receiptof this Order at a time mutually agreed upon by the Commonwealth and defense counsel;

"2. The Commonwealth shall provide the defendant with access to all encrypted digitalstorage devices that were seized from him pursuant to various search warrants issued inconnection with this case;

"3. The defendant shall manually enter the password or key to each respective digitalstorage device in sequence, and shall then immediately move on to the next digital storagedevice without entering further data or waiting for the completion of the process required forthe respective devices to 'boot up';

"4. The defendant shall make no effort to destroy, change, or alter any data contained on thedigital storage devices;

"5. The defendant is expressly ordered not to enter a false or 'fake' password or key, therebycausing the encryption program to generate 'fake, prepared information' as advertised by themanufacturer of the encryption program;


15 of 23 6/26/14, 6:56 AM

"6. The Commonwealth shall not view or record the password or key in any way; [and]"7. The Commonwealth shall be precluded from introducing any evidence relating to thisOrder or the

manner in which the digital media in this case was decrypted in its case in chief. Further, theCommonwealth shall be precluded from introducing any such evidence whatsoever except tothe extent necessary to cure any potentially misleading inferences created by the defendantat trial relating to this matter."

At the hearing on the motion to compel decryption, the Commonwealth stated that it "wouldbe seeking to introduce the fact of encryption in order to suggest consciousness of guilt."

FN11. Generally speaking, "discovery matters are committed to the sound discretion of thetrial judge." Buster v. George W. Moore, Inc., 438 Mass. 635, 653 (2003). "We will upholddiscovery rulings unless the appellant can demonstrate an abuse of discretion that resultedin prejudicial error." Id., citing Solimene v. B. Grauel & Co., 399 Mass. 790, 799 (1987).However, we review a judge's rulings on mixed questions of fact and law de novo. SeeMcCarthy v. Slade Assocs., 463 Mass. 181, 190 (2012); Commissioner of Revenue v.Comcast Corp., 453 Mass. 293, 303 (2009).

FN12. In Malloy v. Hogan, 378 U.S. 1, 8 (1964), the United States SupremeCourt held that the Fifth Amendment privilege against self-incrimination applies to the Statesthrough the Fourteenth Amendment to the United States Constitution. See Commonwealth v.Simon, 456 Mass. 280, 285 n. 4, cert. denied, 131 S.Ct. 181 (2010).

FN13. Because the actual files and documents that are located on the defendant's computerswere voluntarily created by the defendant in the course of his real estate dealings, they arenot testimonial communications that enjoy Fifth Amendment protection.

See United States v. Hubbell, 530 U.S. 27, 35-36 (2000) (recognizing "settled propositionthat a person may be required to produce specific documents even though they containincriminating assertions of fact or belief because the creation of those documents was not'compelled' within the meaning of the [Fifth Amendment] privilege"); United States v. Doe,465 U.S. 605, 611-612 (1984); Fisher v. United States, 425 U.S. 391, 409-410 (1976).

FN14. We note that compliance with an order for the production of specific documentspursuant to a subpoena may be deemed to be a testimonial communication of the fact thatthe documents produced are the ones demanded, thereby constituting authentication ofthose documents. See Fisher v. United States, 425 U.S. at 412-413 & n. 12. Here, thedefendant's decryption ofhis computers does not present an authentication issue analogous to that arising from asubpoena for specific documents because he is not selecting documents and producing them,but merely entering a password into encryption software.


16 of 23 6/26/14, 6:56 AM

FN15. We have held, for example, that art. 12 of the Massachusetts Declaration of Rightsdoes not allow a defendant's refusal to submit to a breathalyzer test to be admitted inevidence. Compare Opinion of the Justices, 412 Mass. 1201, 1209-1211 (1992), with SouthDakota v. Neville, 459 U.S. 553, 562-564 (1983). We also have held that a custodian ofcorporate records may invoke his art. 12 right against self-incrimination in response to asubpoena for those records where the act of production itself would be personallyincriminating. Compare Commonwealth v. Doe, 405 Mass. 676, 678 (1989), with Braswell v.United States, 487 U.S. 99, 108-110 (1988). Additionally, we have held that the type ofimmunity that provides the requisite degree of protection for art. 12 purposes is so-calledtransactional immunity, which affords broader protection that the "use and derivative useimmunity" required by the Fifth Amendment. Compare Attorney Gen. v. Colleton, 387 Mass.790, 795-801 & n. 4 (1982), with Kastigar v. United States, 406 U.S. 441, 453 (1972).

FN16. As properly enunciated by the Commonwealth in its protocol, see note 10, supra, thecompelled act of computer decryption cannot be used to prove that the defendant hadcustody and control over the computers. Cf. Commonwealth v. Burgess, 426 Mass. 206, 220(1997).

FN1. The Commonwealth's proposed order requires the defendant to decrypt "all" of the"digital storage devices that were seized from him." These include two desktop computersand a laptop computer seized from his house; a "netbook" computer seized from hisautomobile; an external hard drive; two universal serial bus (USB) "thumb" drives (alsoknown as "flash drives," "USB drives," and "sticks"); fourteen compact discs; two securedigital cards; and two cellular telephones. The devices were seized pursuant to a searchwarrant issued based on an affidavit by a State trooper involved in the investigation. Theaffidavit sought, inter alia, "[c]omputers and/or electronic storage devices capable of storingany of the below-described records and/or data"; it encompassed "[a]ny and all records,documents, items, and/or data, in whatever form, relating in any way to" a lengthy list ofbroadly defined items.

FN2. A "netbook" is a smaller, more lightweight, and less powerful type of laptop computerusually used for Internet and electronic mail (e-mail) access.See Cloud Control: Copyright, Global Memes and Privacy, 10 J. Telecomm. & High Tech. L.53, 58 & n. 27 (2012). Flash drives "are solid state memory devices that can comfortably becarried on a key chain. They can be used, usually thru a USB port, much like an externalhard drive." United States v. Burgess, 576 F.3d 1078, 1090 n. 12 (10th Cir.), cert. denied,558 U.S. 1097 (2009). Like flash drives, secure digital cards are a type of "solid-statememory technology that stores information when not powered," but they "serve differentfunctions and have limitations that USB flash drives do not"; secured digital cards "are thincards used in phones or cameras that serve primarily as digital film substitutes." SandiskCorp. v. Kingston Tech. Co., 863 F.Supp.2d. 815, 819-820 (W.D.Wis.2012). They are "notreadily compatible with computers and often require a special adaptor to interface with acomputer's USB port." Id. at 820.


17 of 23 6/26/14, 6:56 AM

FN3. That no individual file would be decrypted on the computer's disk drive until someonerequested that particular file is of no moment. According to the Commonwealth's expert, theact of entering the decryption key is what would permit the decryption program to runautomatically and provide readable access to an individual file upon request.

FN4. The issue, of course, is not whether the decrypted contents of thecomputer are "testimonial," but whether the act of decrypting the computer and therebyproducing decrypted information is "testimonial" under the Fifth Amendment to the UnitedStates Constitution and art. 12 of the Massachusetts Declaration of Rights.

FN5. The defendant told police that he received the already-executed mortgage assignmentdocuments from Baylor through the United States mail, and that he merely recorded thosedocuments at the relevant registry of deeds.

FN6. The Commonwealth asserts that while, according to the proposed "protocol," it will notintroduce evidence of the manner in which the computers were decrypted (unless thedefendant opens the door), it intends to introduce evidence of the encryption itself asevidence of "consciousness of guilt." The Commonwealth intends to make this argumenteven though encrypting files on computers is now a common business practice that ismandatory in many circumstances. See In re Grand Jury Subpoena Duces Tecum DatedMarch 25, 2011, 670 F.3d 1335, 1347 (2012) (rejecting "the suggestion that simply becausethe devices were encrypted necessarily means that [the defendant] was trying to hidesomething. Just as a vault is capable of storing mountains of incriminating documents, thatalone does not mean that it contains incriminating documents, or anything at all"). See alsoG.L. c. 93H, § 2(requiring adoption of regulations "relative to any person that owns or licenses personalinformation about a resident of the commonwealth" that are designed to "insure the securityand confidentiality" of such information; "protect against anticipated threats or hazards tothe security or integrity of such information; and protect against unauthorized access to oruse of such information"); 201 Code Mass. Regs. §§ 17.00 (2009) (implementing G.L. c.93H); G. Jacobs & K. Laurence, Professional Malpractice § 17.1 (2013) (discussingrequirement, pursuant to G.L. c. 93H and Supreme Judicial Court Interim Guidelines forProtection of Personal Identifying Data, that attorneys "identify reasonably foreseeable risksto records containing such information, control access to it, establish policies regardingstorage and secure transportation of records [e.g., in e-mail correspondence] outside of thepremises, require use of up-to-date computers, firewalls, anti-virus software, and secureencryption of all electronically stored and transported data " [emphasis supplied] ); John W.Sime, Selecting a Law Firm Cloud Provider, 93 Mich. B.J. 48, 49 (2013) ("Data should beencrypted at two stages. The first stage is during data transmission.... [D]ata should also beencrypted while in storage at the cloud provider"). Moreover, it also seems likely, and theCommonwealth has not stated otherwise, that, should any such documents be produced onany of the seized devices, the Commonwealth will seek to characterize evidence of thedefendant's earlier denials as inconsistentstatements, lies, and further consciousness of guilt.


18 of 23 6/26/14, 6:56 AM

FN7. The Commonwealth argues that the order to provide the key to decrypt the computersand thereby produce the unencrypted documents is necessary because encryption createssignificant difficulties for law enforcement officers attempting to prosecute a lengthy list ofserious crimes. In a similar vein, the Commonwealth argues explicitly that it should be ableto compel the decryption of the devices and the production of their content based on thewarrant affidavit, which established probable cause to seize them, as the seizure otherwisehas produced no information that would be useful in prosecuting the charged offenses.

It does not follow, however, that further restrictions should be placed on fundamentalprotections provided by the Fifth Amendment and art. 12, which heretofore have beenenforced by both State and Federal courts, because the prevalence of computers, in thisdigital age, at times may facilitate the commission of crimes. The omnipresence of electronicdevices which may be monitored, tracked, and recorded has likewise afforded unparalleledopportunities to law enforcement officers in their pursuit of criminal investigations. Thatencryption may at times present significant difficulties to law enforcement officers does not,as the Commonwealth suggests, result in a conclusion that the Fifth Amendment privilegeshould be restricted so thatenforcement is made easier. See Blaisdell v. Commonwealth, 372 Mass. 753, 761 (1977)("Where the privilege is applicable, the constitutionally required result is that no balancing ofState-defendant interests is permissible to facilitate the admittedly difficult burdens of theprosecution"). See also Commonwealth v. Doe, 405 Mass. 676, 680 (1989).

FN8. David Papargiris, the director of the Attorney General's computer forensics laboratory,submitted an affidavit in support of the Commonwealth's motion to compel decryption.Papargiris stated that some of the storage devices seized from the defendant's houseindicate use of an encryption program called "DriveCrypt Plus Pack." When this program isinstalled on a computer, the computer displays a particular screen requesting a passwordevery time the computer is started. Nothing further can be done on that computer until theuser enters the password. Because all of the seized computers display the same screen whenthey are started, Papargiris believes that the program is being used for all of the seizedcomputers and separate storage devices.

FN9. As to one external hard drive, the Commonwealth has shown knowledge of twodocuments related to the defendant's own home, not involving Baylor Holdings, Ltd.(Baylor), or Puren Ventures, Inc., and some links (which do not involve documents) tothird-party Web sites.

FN10. The trooper's affidavit details police surveillance and review of surveillance videofootage of the defendant driving to various stores and post offices. Police suspect thedefendant purchased money orders and gift cards at these locations, by filling out forms byhand. Additional surveillance footage shows the defendant on one occasion entering andleaving a court house that also houses a registry of deeds. Cooperating witnesses anddocuments obtained from third parties indicate that an unknown individual purporting torepresent Baylor arranged for checks to be mailed via United States mail to the defendant'sformer office building in Boston.


19 of 23 6/26/14, 6:56 AM

The affidavit also recounts police observations of the defendant suspected to be usingpublicly available and "anonymous" wireless Internet services, which allow access to theInternet without identifying a particular user's Internet Protocol (IP) address, from a varietyof locations, such as restaurants. These suspicions are based largely on his presence atparticular times at locations where such services are available, or in nearby parking lots,and, on two occasions, because he was observed apparently using a laptop.

FN11. Based on the affidavits, the Commonwealth clearly had probable cause to seize thedevices themselves. In this regard, there was reason to think the defendant used someunspecified computer to connect to the Internet incommunicating with the intended victims of the fraud.

FN12. The search warrant affidavit states that the seized computers "are capable of storing,"inter alia, information about the defendant's "contacts and activities" for a period of morethan four months, "anything having do to with" his financial transactions over anapproximately three-year period (although the fraudulent mortgage scheme allegedly lastedfor less than one year), any Internet search, over an unlimited time frame and geographicarea, for residential properties, and "any" document filed with "any Massachusetts Registryof Deeds," again over an unlimited period. The same information is also sought, from "[a]nyand all records, documents, items, and/or data, in whatever form," to be found at thedefendant's house and in his automobile. The affidavit states further that, because"[t]ransferring data files between computers or onto storage devices such as disks is asimple task that takes little time ... once a file is on one computer at a given location--particularly a home--I believe that there is probable cause to believe that it could be movedto any storage device or other computer at that same location." The court does not addresswhether these broad categories and date ranges meet the specificity requirements ofCommonwealth v. McDermott, 448 Mass. 750, 771-775, cert. denied, 552 U.S. 910 (2007)(concluding that each computer file is separate, closed container, and discussing limitationsnecessary onsearches to be conducted of computer hard drives so that warrants to conduct such searchesare not constitutionally infirm). The record here also does not indicate whether theCommonwealth sought a warrant as to the search of each of the devices once they had beenseized and transported to the police laboratory. See id. at 774-775.

FN13. The trooper's affidavit suggests that the defendant made use of third-party servicesover the Internet to establish certain corporate telephone and facsimile numbers The Websites described in the affidavit, however, are explicitly discussed as services which would notrequire placing any documents on a suspect's own computer. They are described aspermitting anonymous use, storing documents on the third-party service provider'scomputers, and permitting access to, for instance, e-mail message attachments withoutdownloading anything to a user's own computer. See United States v. Falso, 544 F.3d 110,112-114 (2d Cir.2008) (warrant affidavit asserting after forensic examination of computerthat defendant "appeared to have gained or attempted to gain" access to Web site whichdistributed and sold child pornography, where e-mail address belonging to defendant waslisted as subscriber to member section of Web site, defendant had Internet service from hishouse, and defendant had been convicted of prior misdemeanor sex offense, did not


20 of 23 6/26/14, 6:56 AM

establish probable cause that images of child pornography would be found on defendant'scomputer).

FN14. Police suspect the two assignments to Baylor are fraudulent based on theircommunication with the closing attorneys involved in the sales of the two properties not longafter the assignments had been recorded, and with the banks that previously held themortgages.

FN15. The trooper's affidavit states, without record support, that evidence seized from theexternal hard drive shows that the defendant used his computers to create the forgedassignments. The documents described as having been observed on the external hard drive,however, which are the only specific documents described as existing on any of the seizeddevices, relate to an unsigned release of a mortgage on the defendant's own property, andnot to any assignment to Baylor; nothing in the affidavit indicates how the documents werecreated.

FN16. As the defendant described it to police, the communication program works like anonline "chat" session; one person types, and the other person sees the message displayedon his or her computer screen. The message that the user types is encrypted before it is sentto the recipient. The program as described is not intended to create and store documents, orto encrypt computer drives, but, rather, to allow users to send messages back and forth in asecureway so that someone trying to eavesdrop on the messages being sent would be unable to doso.

FN17. The court points to the defendant's statement to police that, "[i]n order to decrypt theinformation, he would have to 'start the program' " as being a reference to the "DriveCrypt"encryption software on the computer drives that it takes as an admission of control over thedrives and the ability to decrypt them. The defendant was speaking, however, of thecommunication program he started in order to communicate in a "chat" session with theRussian individuals at Baylor, not of the encryption of the computer drives themselves.According to the defendant's statement, the communication program takes up very littlespace on a computer drive and can be installed on any device, including a removable "flash"drive; the program requires only an Internet connection, and can be run from anywhere, byinserting a "flash" drive into a computer.

The defendant, who is a native of Russia, obtained the program at a financial conference inEurope sometime in 2004, 2005, or 2006, because he intended to develop his business inthe Russian market; he believed that encrypted communication was necessary to addressRussian security concerns. In response to an explicit question, the defendant answered thathe did not know whether the communication program saved the contents of anyconversation on a computerdrive, then clarified that the communication program did not save any of the typedconversations, but, rather, deleted them at the end of a communication session, and that hethought it did not store copies of the conversations because it was intended to be secure.


21 of 23 6/26/14, 6:56 AM

FN18. When asked at another point about the location of the "encryption device" that heused to communicate with Baylor ("Is it on your laptop? Is it on your desktop"?) thedefendant replied, "At different points it was." Whether the defendant was referring to the"laptop" seized from his house or the "netbook" seized from his car is unclear. It is alsounclear which of the two other computers he meant by "your desktop."

FN19. The defendant stated that the computer in his home was in an area accessible toanyone in the house or who came to his home office, and that Baylor employees accessedhis computer using the encrypted communication program. On this record, the governmenthas not shown that the defendant had exclusive access to the computers.

FN20. According to the Commonwealth's expert, the encryption program on the seizedcomputers permits multiple users with distinct passwords, each potentially having access toa different portion of the computer drive. Thegovernment does not currently know how many user accounts exist on any of thecomputers, and to which portions, if any, of any particular computer the defendant hasaccess. See Trulock v. Freeh, 275 F.3d 391, 403-404 (4th Cir.2001) (where two individualsshared use of computer, and both had access to entire computer hard drive, other user didnot have authority to consent to search of suspect's password-protected files on that drive).The ability to enter a password to start the computer does not, therefore, indicate whetherthe defendant has access to or control over all of the different user accounts and differentsections of the computer drives that may have been established on any of the seizedcomputers; it would, however, potentially reveal to the Commonwealth the existence ofother accounts, and possibly others who use the computers, about which the Commonwealthhas indicated no knowledge.

FN21. The question is addressed by the defendant in his brief and by the Commonwealth inits reply brief. While the Commonwealth asserts in its reply brief, prior to a discussion on themerits, that the question of attorney-client privilege is not part of the reported questionbefore the court, the plain language of the Commonwealth's motion to report, which wasallowed, and which is presented by the Commonwealth in its initial brief as "the issuepresented for review," asks, "Can the defendant be compelled pursuant to theCommonwealth's proposed protocol to provide his key to seized encrypted digitalevidence ..." (emphasis supplied)? The joint stipulation of the parties as to the wording ofthe reported question uses identical language.

END OF DOCUMENT

Term

Adobe Reader is required to view PDF images.


22 of 23 6/26/14, 6:56 AM

Doc 1 of 12

Cite List


23 of 23 6/26/14, 6:56 AM